Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 33d28e984a58edfbd7ae4edbc79849652777b422
https://github.com/WebKit/WebKit/commit/33d28e984a58edfbd7ae4edbc79849652777b422
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-11 (Fri, 11 Sep 2026)
Changed paths:
M Source/JavaScriptCore/runtime/JSObject.cpp
M Source/JavaScriptCore/runtime/JSObject.h
M Source/JavaScriptCore/runtime/Structure.cpp
Log Message:
-----------
Cherry-pick 320892@main (f6b9f5b24d8f).
https://bugs.webkit.org/show_bug.cgi?id=323913
[JSC] Fix dead-lock in Structure::flattenDictionaryStructure
https://bugs.webkit.org/show_bug.cgi?id=323913
rdar://187149098
Reviewed by Keith Miller.
It is extremely rare, but
1. Locker<JSCellLock> cellLocker is holding a cellLock()
2. GCSafeConcurrentJSLocker takes m_lock
3. GCSafeConcurrentJSLocker gets destroyed first
4. Deferred GC
happens
while we are taking a cellLock() here.
Then GC will take a cellLock and getting a dead-lock. This patch places
DeferGC to confirm that we do not do GC.
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::shiftButterflyAfterFlattening):
* Source/JavaScriptCore/runtime/JSObject.h:
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
Canonical link:
https://flagged.apple.com:443/proxy?t2=dV8D2L4so9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIwODkyQG1haW4=&emid=6ec9edb7-ea05-4097-969e-7bff2edb67bf&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dx4D8o9Ia2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1ODc3LjExNzdAd2Via2l0Z2xpYi8yLjUy&emid=6ec9edb7-ea05-4097-969e-7bff2edb67bf&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
